Throw explicit exception if server DIGEST challenge has no qop value

Author: markt-asf

java/org/apache/tomcat/websocket/DigestAuthenticator.java

@@ -63,6 +63,9 @@ public String getAuthorization(String method, String requestUri, String authenti
 
         String nonce = parameterMap.get("nonce");
         String messageQop = parameterMap.get("qop");
+        if (messageQop == null || messageQop.isEmpty()) {
+            throw new AuthenticationException(sm.getString("digestAuthenticator.noQop"));
+        }
         String algorithm = parameterMap.get("algorithm") == null ? "MD5" : parameterMap.get("algorithm");
         String opaque = parameterMap.get("opaque");
         if (cnonceGenerator == null) {
@@ -99,11 +102,9 @@ public String getAuthorization(String method, String requestUri, String authenti
             challenge.append("opaque=\"").append(opaque).append("\",");
         }
 
-        if (messageQop != null && !messageQop.isEmpty()) {
-            challenge.append("qop=\"").append(messageQop).append("\"");
-            challenge.append(",cnonce=\"").append(cNonce).append("\",");
-            challenge.append("nc=").append(String.format("%08X", Integer.valueOf(nonceCount)));
-        }
+        challenge.append("qop=\"").append(messageQop).append("\"");
+        challenge.append(",cnonce=\"").append(cNonce).append("\",");
+        challenge.append("nc=").append(String.format("%08X", Integer.valueOf(nonceCount)));
 
         return challenge.toString();
 

java/org/apache/tomcat/websocket/LocalStrings.properties

@@ -44,6 +44,7 @@ clientEndpointHolder.instanceCreationFailed=Failed to create WebSocketEndpoint
 clientEndpointHolder.instanceRegistrationFailed=Failed to register Endpoint instance with the InstanceManager
 
 digestAuthenticator.algorithm=Unable to generate request digest [{0}]
+digestAuthenticator.noQop=The server challenge did not include a qop value
 
 futureToSendHandler.timeout=Operation timed out after waiting [{0}] [{1}] to complete